a0a492ecab453975431d7f371b4f2e3b86380618d343e3a07fd04e45db3c2393

Analysis

max time kernel
1s
max time network
2s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02-11-2022 20:25

Target

012196b352ac6bb3f8791f1fa2164682476d16dc6c6a84531093edcf6eacd31a.exe
Size

302KB
MD5

311f1501f1de06dac2cf6728bf664b48
SHA1

3f1efef35f2de4f4442cc19cc286d135bd39dc79
SHA256

012196b352ac6bb3f8791f1fa2164682476d16dc6c6a84531093edcf6eacd31a
SHA512

7896967c674ea5fe4c27672126d1dcc85a1deab384fa73c75ac875c53a07204d8c0334ff7bf6b3947a2dd7b1f7515d9f45a78ead9b9165872d7d8b740b51582d
SSDEEP

6144:Pi8f+BLtABPDB45GpreKpwSURfa+suohnsgpUA1e04PaZ:PH4sVKSURfaCg91e/a

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

012196b352ac6bb3f8791f1fa2164682476d16dc6c6a84531093edcf6eacd31a.exe

description	pid	process	target process
PID 1152 wrote to memory of 1824	1152	012196b352ac6bb3f8791f1fa2164682476d16dc6c6a84531093edcf6eacd31a.exe	cmd.exe
PID 1152 wrote to memory of 1824	1152	012196b352ac6bb3f8791f1fa2164682476d16dc6c6a84531093edcf6eacd31a.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\012196b352ac6bb3f8791f1fa2164682476d16dc6c6a84531093edcf6eacd31a.exe
"C:\Users\Admin\AppData\Local\Temp\012196b352ac6bb3f8791f1fa2164682476d16dc6c6a84531093edcf6eacd31a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1152